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(54) Location system with enhanced security 



(57) In a location system, gateways maintain priva- 
cy settings of mobile terminals. On receiving a location 
request from a client terminal, each gateway determines 
which of the gateways maintains the privacy settings of 
a target mobile terminal specified in the request, and 
transmits the location request to a gateway if the latter 
maintains the privacy settings of the specified target mo- 
bile terminal. The gateway performs a first privacy check 



on a location request received either from the client ter- 
minal or from other gateway using the privacy settings 
of the target mobile terminal, transmits the request to a 
positioning system to obtain a measurement result indi- 
cating the location of the target mobile terminal if the 
request conforms to the privacy settings, and performs 
a second privacy check on the measurement result us- 
ing the privacy settings. A result of the second privacy 
check is then communicated to the client terminal. 
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Description 

[0001] The present invention relates generally to mo- 
bile communication systems, and more specifically to a 
location system for providing information services to cli- 
ents as to the location of user equipment (UE) terminals. 
[0002] As a value-added feature of mobile communi- 
cation service, location information service is an impor- 
tant subject currently being under study by the Third 
Generation Partnership Program (3GPP) to enhance 
the functionality of mobile terminals. The 3GPP Techni- 
cal Specification 23.271 v.5.1 .0, "Functional stage 2 de- 
scription of LCS", December 2001 (hereinafter Docu- 
ment 1), is a current standard that specifies particulars 
of location information services. Since information as to 
the location of a mobile terminal is very sensitive to the 
user and must be protected, mobile communication net- 
works are provided with sophisticated privacy protection 
functionality which imposes restriction control on ac- 
cesses according to end-user's privacy settings. 
[0003] The privacy settings as requested by mobile 
users are of two types. One is a type of information 
which can be determined at the time a location request 
is sent to the location system, such as the name of cli- 
ents or service classes. The other is of a type of infor- 
mation which can be determined only at the time after 
the location information of the target mobile terminal is 
obtained, such as the geographic location of a target us- 
er equipment or the time of day the location information 
is obtained from the location system. 
[0004] The 3GPP location information system, as de- 
scribed in Document 1 and shown in Fig. 12, is made 
up of client terminal 101, GMLC (Gateway Mobile Loca- 
tion Center) 102, SGSN/MSC (Serving General packet 
radio service Support Node/MobileServicesswitching- 
Center)1 03, local wireless network known as RAN (Ra- 
dio Access Network) 104 and UE (User Equipment) ter- 
minal 1 05 connected to the RAN via wireless link. HLR/ 
HSS (Home Location Register/Home Subscriber Serv- 
er) 106 is connected to the GMLC 102 as a database 
for holding the identity of the RAN to which UE terminals 
are connected. 

[0005] When a location request is sent to the system 
for a target UE terminal, the SGSN/MSC 1 03 that man- 
ages the RAN to which the UE terminal is connected 
takes the responsibility for protecting the privacy of the 
terminal. Client terminals which are authorized to ac- 
cess a UE terminal are registered in the location system 
in advance by the user of the UE terminal in order to 
protect the user from unauthorized accesses. 
[0006] However, a need has recently arisen to provide 
versatile protection functionality, the current client- 
based scheme is not sufficient to fulfil the need. To im- 
plement a versatile protection mechanism for a given 
service area of the current 3GPP system, it would be 
necessary to extend the privacy check functionality of 
all SGSN/MSC systems that exist in that service area. 
However, the introduction of such a versatile protection 
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mechanism in the SGSN/MSC systems would be too 
costly if future expansion and system growth are to be 
taken into account. It is desired that a versatile privacy 
check mechanism should be provided in a system other 

5 than SGSN/MSC. Additionally, a desirable feature of the 
versatile protection mechanism is to protect UE termi- 
nals roaming in an external network from unauthorized 
access from client terminals of the external network. 
[0007] With the background just described, an en- 

10 hanced privacy check mechanism has been proposed 
in Chapter 7 of 3GPP Technical Report 23.871 v1 . 1 .0, 
"Enhanced support for User Privacy in location servic- 
es", tdoc S2-020316, January 23, 2002 (hereinafter 
Document 2). 

15 [0008] However, privacy items protected by the en- 
hanced mechanism relate only to those associated with 
the time at which location request is made and sent to 
the location service system. No consideration is taken 
of those privacy items which can be determined only at 

20 the time after the location information of the target mo- 
bile terminal is obtained. Furthermore, while Document 
2 proposes a scheme for serving requests from clients 
of a remote network to UE terminals of a home network 
through collaborations between the networks, specific 

25 functions and responsibilities are yet to be determined. 
[0009] It is therefore a primary object of the present 
invention to provide a method and a system for securing 
location-service privacy protection not only for privacy 
parameters known at the time a location request is 

so made, but those privacy parameters which can be de- 
termined only at the time after the location information 
of the target mobile terminal is obtained. 
[0010] It is another object of the present invention to 
provide a method and a system for securing location- 

35 service privacy protection for location requests from cli- 
ents of an external network requesting the location of 
UE terminals of a home network by allocating functions 
and responsibilities to gateways of the networks. 
[001 1 ] It is a further object of the present invention to 

40 provide a method and a system for securing location- 
service privacy protection for an event-triggered loca- 
tion request which may encounter privacy settings 
which have already been altered during the time priorto 
the occurrence of the event. 

45 [0012] According to a first aspect, the primary object 
of the present invention is obtained by a location system 
comprising a plurality of mobile terminals, a client termi- 
nal for transmitting a location request specifying a target 
mobile terminal, a positioning system accessible to the 

50 mobile terminals for producing location information in re- 
sponse to a location request, and a gateway for holding 
privacy settings of the mobile terminals, performing a 
first privacy check on a location request of the client ter- 
minal using the privacy settings of a target mobile ter- 

55 minal specified by the request, transmitting the request 
to the positioning system to obtain location information 
if the request conforms to the privacy settings, and per- 
forming a second privacy check on the location informa- 
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tion using the privacy settings of the target mobile ter- 
minal. 

[0013] According to a second aspect, the present in- 
vention provides a location system comprising a plural- 
ity of mobile terminals, a plurality of client terminals for 
transmitting a location request specifying a target mo- 
bile terminal, a positioning system accessible to the mo- 
bile terminals for producing location information of the 
mobile terminal in response to a location request, and 
a plurality of gateways for maintaining privacy settings 
of the mobile terminals. On receiving a location request 
from a client terminal, each gateway determines which 
of the gateways maintains the privacy settings of the 
specified target mobile terminal, and transmits the loca- 
tion request to a gateway if this gateway maintains the 
privacy settings of the specified target mobile terminal. 
Each gateway performs a first privacy check on a loca- 
tion request received either from the client terminal or 
from other gateway using the privacy settings of the 
specified target mobile terminal maintained in the gate- 
way, transmits the request to the positioning system to 
obtain location information of the mobile terminal if the 
request conforms to the privacy settings, and performs 
a second privacy check on the location information us- 
ing the privacy settings maintained in the gateway. 
[0014] According to a further aspect, each gateway is 
arranged to transmit an event-triggered location request 
to the positioning system to obtain location information 
of the target mobile terminal if a specified event occurs 
with respect to the target mobile terminal, perform the 
second privacy check on the location information if the 
privacy settings of the target mobile terminal is not al- 
tered before the location information is obtained from 
the positioning system, and transmit a cancellation re- 
quest to the positioning system if the privacy settings of 
the target mobile terminal is altered before the location 
information is obtained from the positioning system. 
[0015] The present invention will be described in de- 
tail further with reference to the following drawings, in 
which: 

Fig. 1 is a block diagram of a location system of the 
present invention for implementing location servic- 
es with enhanced support for user privacy in a multi- 
network environment; 

Figs. 2A, 2B and 2C are a flowchart of the operation 
of GMLCs of Fig. 1 when a location request is re- 
ceived from the associated client terminal; 
Fig. 3 is a sequence diagram for illustrating a series 
of events that occur across the location system 
when a home network client is requesting the loca- 
tion information of a UE terminal from the home net- 
work; 

Fig. 4 is a sequence diagram for illustrating a series 
of events that occur across the location system 
when a home network client is requesting the loca- 
tion information of a UE terminal from an external 
network; 
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Fig. 5 is a flowchart of the operation of a home GM- 
LC when a location request is repeatedly transmit- 
ted from a requesting GMLC to the home GMLC ac- 
cording to a modified embodiment of the present in- 
5 vention; 

Fig. 6 is a sequence diagram of a series of events 
that occur across the location system when the rou- 
tine of Figs. 2A, 2B and 5 is executed; 
Figs. 7A and 7B are a flowchart of the operation of 
10 a remote GMLC when a location information re- 
quest is repeatedly transmitted from the remote 
GMLC to an SGSN/MSC according to a further 
modification of the present invention; 
Fig. 8 is a sequence diagram of a series of events 
15 that occur across the location system when the rou- 
tine of Figs. 2A, 7A and 7B is executed; 
Fig. 9 is a flowchart of the operation of a remote 
GMLC when an event-triggered location request is 
sent to an SGSN/MSC to obtain location informa- 
nt? tion of a target UE terminal when an event occurs 
in the target UE terminal; . 
Figs. 10A and 10B are sequence diagrams of a se- 
ries of events that occur in the system when the rou- 
tine of Figs. 2A, 2C and 9 is executed; 
25 Fig. 1 1 is a block diagram of a modified location sys- 
tem of the present invention; and 
Fig. 1 2 is a block diagram of a prior art location sys- 
tem. 

30 [0016] Referring now to Fig. 1 , there is shown a loca- 
tion system of a mobile multi-network environment ac- 
cording to the present invention. The location service 
system is comprised of a plurality of GMLCs (gateway 
mobile location centers) 202 and 21 2 to which client ter- 

35 minals 201 and 211 are respectively connected to send 
their location requests. GMLC 202 is connected to SG- 
SN/MSCs (serving GPRS support node/mobile service 
switching centers) 203 and 213. GMLC 212 is also con- 
nected to both SGSN/MCSs 203, 213. Further, both 

40 GMLCs are interconnected to each other to send a lo- 
cation request to the other GMLC when the request is 
for a UE terminal of the external network. RANs 204 and 

214 are connected to SGSN/MSCs 203, 213, respec- 
tively. UE terminals 205 and 215 are connected via a 

^5 wireless link to the RANs 204, 214, respectively. For 
simplicity, only one RAN is shown connected to each 
SGSN/MSC as a, representative of a number of RANs 
managed by the associated SGSN/MSC. Identification 
data of SGSN/MSC 203, which manages RAN 204 

so where UE terminal 205 is connected, is maintained in 
an HLR/HSS (home location register/home subscriber 
server) 206 and the identification data of SGSN/MSC 
213, which manages RAN 214 where UE terminal 215 
is connected, is maintained in an HLFVHSS 216. The 

55 privacy settings of UE terminal 205 are stored in GMLC 
202 and the identification data of GMLC 202 is stored 
in HLR/HSS 206. The privacy settings of UE terminal 

215 are stored in GMLC 212 and the identification data 
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of GMLC 212 is stored in HLR/HSS 216. Each of the 
HLR/HSS 206 and 216 is connected to both GMLCs 
202, 212. 

[0017] Each of the GMLCs 202 and 212 operates ac- 
cording to a flowchart shown in Figs. 2A, 2B and 2C. 
[001 8] In response to a location request either from a 
client terminal or other GMLC (step 301, Fig. 2A), the 
GMLC of each network (hereinafter requesting GMLC) 
proceeds to step 302 to check to see if the location re- 
quest is from a client terminal or from other GMLC. If it 
is determined that the location request is from a client 
terminal, flow proceeds from step 302 to step 303 to ver- 
ify the authentication of the requesting client terminal. If 
the verification fails, flow proceeds to step 327 (Fig. 2C) 
to send an error message to the requesting client termi- 
nal. 

[0019] If the client terminal is verified (step 304), flow 
proceeds to step 305 to determine whether a home GM- 
LC that manages the privacy information of the target 
UE is already known. If the requesting GMLC is the pri- 
vacy management node of the target UE terminal, the 
decision at step 305 is affirmative and flow proceeds to 
step 308. 

[0020] If the decision at step 305 is negative, flow pro- 
ceeds to step 306 to send an enquiry message to the 
HLR/HSS of the network which the target UE belongs 
to, in order to obtain information as to the identity of a 
home GMLC that maintains the privacy information of 
the target UE. If the identity of the home GMLC is ob- 
tained from the HLR/HSS, the decision at step 307 is 
affirmative and flow proceeds to step 308 to determine 
whether the received GMLC identity indicates that the 
requesting GMLC is the home GMLC of the target UE. 
[0021] If it is determined, at step 308, that the request- 
ing GMLC is the home GMLC, the requesting GMLC 
proceeds to step 311 (Fig. 2B) to perform a privacy 
check on the location request based on the privacy set- 
tings of the target UE terminal and determines whether 
the location request received from the client terminal 
conforms to the privacy settings of the UE terminal (step 
312). If the location request conforms to the privacy set- 
tings of the target UE, the home GMLC proceeds from 
step 31 2 to step 31 3 to send an enquiry message to the 
HLR/HSS system for requesting the identity of SGSN/ 
MSC that manages the target RAN. 
[0022] If the UE terminal 205 is the target UE, the 
identity of SGSN/MSC 203 will be received (step 314) 
and the home GMLC proceeds to step 315 to transmit 
a location request to the SGSN/MSC. In response to the 
location request from the home GMLC, the SGSN/MSC 
begins to process location estimation by collaborating 
with the RAN and the target UE terminal and transmits 
the location information of the target UE terminal to the 
home GMLC. 

[0023] When the home GMLC receives a response 
message from the SGSN/MSC (step 316), it proceeds 
to step 31 7 to process the received location information 
according to the privacy settings of the target UE termi- 



nal 205 and performs a privacy check on the processed 
location information. At step 31 8, the processed location 
information is checked against the privacy settings of 
the target U E for conformance. If the processed location 

5 information conforms to the privacy settings of the target 
UE, flow proceeds from step 318 to step 321 (Fig. 2C) 
to check to see if the location request originally received 
at step 301 is from other GMLC If the location request 
initially received at step 301 is from the client terminal, 

10 the decision at step 321 is negative and the home GMLC 
proceeds to step 322 to process the location information 
according to the preference settings specified by the cli- 
ent terminal. If the client wishes to receive the location 
information as address information, this data processing 

is is a process of format conversion from geographical co- 
ordinate system (latitude and longitude) to address in- 
formation on a geographic map. At step 323, the location 
information is transmitted from the local GMLC to the 
requesting client terminal. 

20 [0024] If a location request the home GMLC has re- 
ceived is from a remote GMLC, the decision at step 302 
is affirmative and flow proceeds to step 309 to verify the 
authentication of this GMLC. If the remote GMLC is not 
verified at step 31 0, an error message is sent to the re- 

25 mote GMLC (step 327). If the remote GMLC is verified, 
flow proceeds to step 311 to perform a privacy check on 
the received location information as described above. 
[0025] If the requesting GMLC is not the UE-privacy 
management node, the decision at step 308 is negative, 

30 and flow proceeds to step 325 (Fig. 2C) to send a loca- 
tion request to the home GMLC and waits for location 
information from the home GMLC at step 326. When lo- 
cation information is received from the home GMLC, 
flow proceeds from step 326 to step 322 to process the 

35 location information according to the preference set- 
tings of the client terminal and transmit the processed 
location information to the client terminal. If no location 
information is received, flow proceeds from step 326 to 
step 327 to send an error message to the client terminal. 

40 [0026] If the decision atsteps312, 314, 316 and318 
is negative, flow proceeds to step 327 to send an error 
message to the requesting source. 
[0027] Therefore, if the client terminal 201 requested 
the location information of the U E terminal 205, the GM- 

45 LC 202 will receive a location request 401 (see Fig. 3) 
from the client terminal 201 (steps 301 to 304). If the 
GMLC 202 does not know the identity of the GMLC 
which manages the privacy settings of the target UE, 
the decision at step 305 will be negative and the GMLC 

so 202 sends an enquiry message 402 at step 306 to the 
HLR/HSS 206. The GMLC 202 receives, at step 307, a 
response message 403 from the HLR/HSS 206, indicat- 
ing that GMLC 202 is the privacy management node of 
the target UE terminal 205. Thus, the GMLC 202 makes 

55 an affirmative decision at step 308 and performs a pri- 
vacy check 404 at step 31 1 . If the GMLC 202 knows that 
it is the managing node of the privacy settings of the 
target UE, the decision at step 305 is affirmative, steps 
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306 and 307 will be skipped. 

[0028] Once the privacy check 404 has been per- 
formed (step 311) and conformance indicated (step 
31 2), an enquiry message 405 is sent (step 31 3) to the 
HLR/HSS 206 for requesting it to respond with a mes- 
sage 406 containing the identity of an SGSN/MSC that 
manages the RAN 204 where the target UE is connect- 
ed (step 314). A location request 407 is sent from the 
GMLC 202 (step 315) to the SGSN/MSC 203. In re- 
sponse to the location request 407, the SGSN/MSC 203 
begins to process location estimation by collaborating 
with the RAN 204 and the target UE terminal 205 (as 
indicated by an event 408) and transmits the location 
information of the target UE 205 as a response message 
409 to the GMLC 202. The location information con- 
tained in the response message 409 is processed ac- 
cording to the UE's privacy settings. Privacy check 410 
is then performed on the processed location information 
at step 317 to check to see if it conforms to the UE's 
privacy settings (step 318). The GMLC 202 processes 
the location information according to the preference set- 
tings of the client terminal 201 (step 322). The proc- 
essed location information is transmitted in a message 
41 1 to the client terminal 201 . 

[0029] Therefore, if the client terminal 211 requested 
the location information of the UE terminal 205, the GM- 
LC 212 will receive a location request 501 (see Fig. 4) 
from the client terminal 211 (steps 301 to 304). If the 
GMLC 202 has no knowledge of the identity of the GM- 
LC which manages the privacy settings of the target UE, 
the decision at step 305 will be negative and the GMLC 
212 sends an enquiry message 502 at step 306 to the 
HLR/HSS 206. The GMLC 212 receives, at step 307, a 
response message 503 from the HLR/HSS 206, indicat- 
ing that GMLC 202 is the privacy management node of 
the target UE terminal 205. Therefore, the GMLC 212 
makes a negative decision at step 308 and proceeds to 
step 325 (Fig. 2C) to send a location request 504 to the 
GMLC 202. This location request may contain client in- 
formation such as the display format of location infor- 
mation and functions supported by the client terminal. 
The GMLC 202 receives this location request 504 at 
step 301 and makes an affirmative decision at step 302 
and proceeds to step 309 to verify the authentication of 
GMLC 212. If the GMLC 21 2 is verified (step 31 0), flow 
proceeds to step 31 1 to perform a privacy check 505 on 
the received location information. 
[0030] Once the privacy check 505 has been per- 
formed (step 311) and conformance indicated (step 
312), the GMLC 202 sends an enquiry message 506 
(step 313) to the HLR/HSS 206 for requesting it to re- 
spond with a message 507 containing the identity of an 
SGSN/MSC that manages the RAN 204 where the tar- 
get UE is connected (step 314). A location request 508 
is sent from the GMLC 202 (step 31 5) to the SGSN/MSC 
203. In response to the location request 508, the SGSN/ 
MSC 203 begins to process location estimation by col- 
laborating with the RAN 204 and the target UE terminal 



205 (as indicated by an event 509) and transmits the 
location information of the target UE 205 in a response 
message 510 to the GMLC 202. The location informa- 
tion contained in the response message 510 is proc- 

5 essed according to the UE's privacy settings and a pri- 
vacy check 511 is performed at step 317 and checked 
against the UE's privacy settings for conformance (step 
318). Flow proceeds from step 318 to step 321. Since 
the original location request has been received from the 

10 GMLC 212, the GMLC 202 makes an affirmative deci- 
sion at step 321 and proceeds to step 324 to send the 
location information in a message 51 2 to the GMLC 212. 
Following the transmission of the location request 504, 
the GMLC 212 has been waiting for the location re- 

15 sponse at step 326. On receiving the message 51 2, the 
GMLC 21 2 proceeds to step 322 to process the received 
location information according to the preference set- 
tings of the client terminal 211 and transmits the proc- 
essed location information in a message 513 to the cli- 

20 ent terminal 211 (step 323). 

[0031] It will be seen from the foregoing description 
that enhanced privacy protection is achieved since pri- 
vacy check is performed on location information before 
the client terminal is notified of location information. 

25 [0032] Further, the client terminal dependent process- 
es are handled by a GMLC which has received a loca- 
tion requestfrom the client terminal, while the target UE- 
privacy dependent processes are handled by a GMLC 
which maintains the privacy settings of the target U E ter- 

30 minal. As a result, the home and external networks can 
jointly operate in an efficient manner to process a loca- 
tion request received from a client terminal. 
[0033] According to variations of the present inven- 
tion, location information of a target UE terminal can be 

35 obtained at periodic intervals. 

[0034] A flowchart shown in Fig. 5 is a modification of 
the flowchart of Fig. 2C. In Fig. 5, a timer is started at 
step 330 immediately following the transmission of a lo- 
cation request from the requesting GMLC to a home 

40 GMLC (step 325). After receiving location-information 
from the home GMLC (step 326), flow proceeds to step 
331 to process the received location information accord- 
ing to the preference settings of the client terminal and 
transmits the processed location information to the cli- 

45 ent terminal at step 332, in a manner identical to steps 
322 and 323. The requesting GMLC checks to see if the 
timer has reached its time-out period. If this is the case, 
flow proceeds to step 334 to check to see if the trans- 
mission of a location request has been repeated a pre- 

50 determined number of times. If not, flow returns to step 
325 to send the next location request to the home GM- 
LC. When the transmission of a location request have 
been repeated the predetermined number of times, flow 
advances to the end of the routine. 

55 [0035] A sequence diagram of Fig. 6 illustrates a se- 
ries of events that occur when the requesting GMLC op- 
erates according to the routine of Figs. 2A, 2B and 5. In 
Fig. 6, parts corresponding in significance to those of 
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Fig. 4 are marked with the same numerals. Therefore, 
events proceed in the same manner as those of Fig. 4 
until the GMLC 212 transmits the location Ginformatiori 
51 3 to the client terminal 211. When the location request 
504 is initially transmitted from the GMLC 21 2 to the GM- 
LC 202, the timer is started (step 330). Following the 
initial transmission of location information 513, the timer 
expires (step 333) and the next location request 504 is 
transmitted from the GMLC 212 to the GMLC 202. The 
location information is repeatedly produced and trans- 
mitted to the client terminal until the count number of the 
repetitions attains a predetermined value (step 334). 
[0036] Instead of the requesting GMLC, the home 
GMLC may perform the timing operation. The flowchart 
of Fig. 2B is modified as shown in Fig. 7 A to include step 
340 where the timer is started immediately following the 
transmission of a first location request to the SGSN/ 
MSC at step 315. The flowchart of Fig. 2C is modified 
as shown in Fig. 7B by the inclusion of steps 341 to 344 
following step 321 . If the original location request is re- 
ceived from the client terminal, the decision at step 321 
is negative and flow proceeds to step 341 to process the 
location information previously received at step 316 
(Fig. 7A) according to the client's settings and the proc- 
essed location information is transmitted to the client 
(step 342) in the same way as discussed in connection 
with steps 322 and 323. Step 343 makes a time-out 
check on the timer. If the timer has expired, flow pro- 
ceeds to step 344. If the count number of repetitions is 
smaller than the predetermined value, flow returns to 
step 315 (Fig. 7A) to transmit the next location request 
to the SGSN/MSC. 

[0037] A sequence diagram of Fig. 8 illustrates a se- 
ries of events that occur when the GMLC 202 operates 
according to the routine of Figs. 2A, 7A and 7B. In Fig. 
8, parts corresponding in significance to those of Fig. 4 
are marked with the same numerals. Therefore, events 
proceed in the same manner as those of Fig. 4 until the 
GMLC 21 2 transmits the location information 51 3 to the 
client terminal 211. When the GMLC 202 transmits a lo- 
cation request to the SGSN/MSC 203 (as event 508) 
(step 315), the timer is started (step 340). Following the 
initial transmission of location information 51 3, the timer 
expires (step 343) and the next location request is trans- 
mitted as event 508 from the GMLC 202 to the SGSN/ 
MSC 203. In this way, the location information is repeat- 
edly produced and transmitted to the client terminal until 
the count number of the repetitions attains a predeter- 
mined value (step 344). 

[0038] A further modification of the present invention 
is shown in Fig. 9 in which parts corresponding in sig- 
nificance to those in Fig. 2B are marked with the same 
numerals. Fig. 9 differs from Fig. 2B in that it further in- 
cludes steps 350 to 355. Following the acquisition of the 
identity of an SGSN/MSC at step 314, an event-trig- 
gered location request is sent from the home GMLC to 
the SGSN/MSC (step 350), requesting the latter to ini- 
tiate location information processing if an event speci- 



fied in the request message (such as when the target 
UE encounters an inter-cell handover or when the target 
UE returns to the network) has occurred with respect to 
the target UE terminal and send the location information 

5 backto the home GMLC. Flow proceeds to decision step 
351 to determine whether the privacy settings of the tar- 
get UE terminal has been altered. If this is the case, the 
home GMLC determines whether the altered settings 
relate only to location information. If the decision is af- 

10 firmative, flow proceeds to decision step 31 6 to wait for 
location information of the target UE from the SGSN/ 
MSC. 

[0039] If thealtered privacy settings do not exclusively 
relate to location information, the decision at step 351 

15 or 352 is negative and the home GMLC proceeds to step 
353 to determine whether cancellation of the event-trig- 
gered location request is required. If cancellation is not 
required, flow proceeds to step 316. If cancellation is 
required, a cancellation request is sent to the SGSN/ 

20 MSC to cancel the even -triggered location request (step 
354) and wait for a cancellation response from the SG- 
SN/MSC (step 355). When a cancellation response is 
received, flow proceeds to step 327 to send an error 
message. 

25 [0040] If the routine of Figs. 2A, 2C and 9 is performed 
to transmit an event-triggered location request from the 
home GMLC to the SGSN/MSC and an event is actually 
triggered by the target UE, a series of events similar to 
that of Fig. 4 may take place as shown in Fig. 10A, in 

30 which parts corresponding in significance to those of 
Fig. 4 are marked with the same numerals. When an 
event -triggered location request 508 is transmitted from 
the GMLC 202 to the SGSN/MSC 203 (step 350), the 
GM LC 202 enters a standby mode waiting for the occur- 

35 re nee of a specified event with respect to the target UE. 
If there is no alteration in the privacy settings of the tar- 
get UE terminal until the event occurrence, flow pro- 
ceeds from step 350 through steps 351 , 352 or 353 to 
step 316 to wait for location information. Meanwhile, a 

^o process for producing location information (509) begins 
when the event occurs, and a location response mes- 
sage 51 0 is sent from the SGSN/MSC 203 to the GMLC 

202. In response to this message, the GMLC 202 per- 
forms a privacy check 511 (steps 317, 318). 

45 [0041] If the privacy settings of the target UE have 
been altered while waiting for the event, a series of 
events may take place in the location system as shown 
in Fig. 10B. When an event-triggered location request 
508 is transmitted from the GMLC 202 to the SGSN/ 

so MSC 203 (step 350), the GMLC 202 enters a standby 
mode waiting for the occurrence of the event. If the pri- 
vacy settings of the target UE have been altered while 
waiting for the event, flow proceeds from step 350 
through steps 351 , 352 or 353 to step 354 to send a 

55 cancellation message 520 is sent to the SGSN/MSC 

203. The SGSN/MSC 203 replies with a cancellation re- 
sponse message 512, which is detected at step 355 and 
an error message is sent to the GMLC 212. 
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[0042] Since the decision mechanism identifies an 
event-triggered location request which would be ad- 
versely affected by altered privacy settings, the present 
invention eliminates useless transactions which woufd 
otherwise be generated while the system is waiting for 
an event. 

[0043] As shown in Fig. 11 , the location system of Fig. 
1 is modified to include privacy profile registers (PPR), 
or privacy managers 207 and 217 to store privacy set- 
tings of the UE terminals 205 and 215, respectively. 
PPRs 207 and 217 are connected to the GMLCs 202 
and 212, respectively. In this embodiment, privacy 
check is performed by collaboration between each GM- 
LC and the associated PPR. When the GMLC 202, for 
example, performs a privacy check, it sends a request 
message to the associated PPR 207 that holds the pri- 
vacy settings of the UE terminal 205. PPR 207 may be 
entrusted to conduct a privacy check by using the stored 
settings of the target UE and sends the result of the 
check to the requesting GMLC. Alternatively, the PPR 
207 is requested to send the privacy settings of the tar- 
get UE to the requesting GMLC and the latter takes re- 
sponsibility to perform the privacy check by using the 
transmitted privacy setting. 



Claims 

1 . A location system comprising: 

a plurality of mobile terminals (205, 215); 
a client terminal (201 , 211) for transmitting a lo- 
cation request specifying a target mobile termi- 
nal; 

a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 
nal in response to a location request; and 
a gateway (202, 212, 206, 216, 207, 217) for 
holding privacy settings of the mobile terminals, 
performing a first privacy check on a location 
request of the client terminal using the privacy 
settings of a target mobile terminal specified by 
the request, transmitting said location request 
to the positioning system to obtain said location 
information, and performing a second privacy 
check on said location information using the pri- 
vacy settings of said target mobile terminal. 

2. A location system comprising: 

a plurality of mobile terminals (205, 215); 
a plurality of client terminals (201, 211) for 
transmitting a location request specifying a tar- 
get mobile terminal; 

a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 



nal in response to a location request; and 
a plurality of gateways (202, 212) for maintain- 
ing privacy settings of the mobile terminals, 
each gateway receiving a location request from 

5 a client terminal, determining which of the gate- 

ways maintains the privacy settings of the spec- 
ified target mobile terminal, and transmitting 
the location request to a gateway which main- 
tains the privacy settings of the specified target 

10 mobile terminal, 

each gateway, which maintains privacy settings 
of the specified target mobile terminal, perform- 
ing a first privacy check on a location request 
received either from the client terminal or from 

15 other gateway using the privacy settings of the 

specified target mobile terminal maintained in 
the gateway, transmitting the request to the po- 
sitioning system to obtain location information 
of the target mobile terminal, and performing a 

20 second privacy check on said location informa- 

tion using the privacy settings maintained in the 
gateway. 

3. The system of claim 1 or 2, wherein the location re- 
25 quest transmitted to the gateway that maintains the 
privacy settings of the target mobile terminal in- 
cludes information as to the client terminal indicat- 
ing functionality of the client terminal. 

30 4. The system of claim 1 , 2, or 3, wherein each of said 
gateways is arranged to transmit a copy of said re- 
quest to said positioning system at periodic inter- 
vals to obtain a plurality of location information of 
the target mobile terminal, regardless of whether 

35 said request has been received from a client termi- 
nal or from other gateway. 

5. The system of claim 1 , 2, 3 or 4, wherein each of 
said gateways is arranged to transmit a copy of said 
40 request at periodic intervals to a gateway of an ex- 
ternal network if the gateway of the external network 
maintains the privacy settings of the specified target 
mobile terminal. 

45 6. The system of any one of claims 1 to 5, wherein 
each of said gateways is arranged to transmit a 
copy of said request at periodic intervals to said po- 
sitioning system if the gateway maintains the priva- 
cy settings of the specified target mobile terminal. 

50 

7. The system of any one of claims 1 to 6, wherein 
each of said gateways is arranged to: 

transmit an event-triggered location request to 
55 said positioning system to obtain location infor- 

mation of the target mobile terminal if a speci- 
fied event occurs in the target mobile terminal, 
perform said second privacy check on said lo- 
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cation information if the privacy settings of the 
target mobile terminal is not altered before said 
location information is obtained from the posi- 
tioning system, and 

transmit a cancellation request to said position- 
ing system if the privacy settings of the target 
mobile terminal is altered before said location 
information is obtained from the positioning 
system. 

8. The location system of claims 1 to 7, further com- 
prising a plurality of databases (207, 21 7) for main- 
taining the privacy settings of the mobile terminals 
and collaborating with a corresponding one of said 
gateways to perform said first and second privacy 
check. 

9. The location system of claims 1 to 8, wherein said 
positioning system comprises a plurality of mobile 
switching systems, and wherein each of said gate- 
ways is connected to one or more of said mobile 
switching systems. 

1 0. The system of any one of claims 1 to 9, wherein said 
gateways respectively belong to different networks. 

11. The system of claim 9 or 10, wherein said mobile 
switching systems respectively belong to said dif- 
ferent networks. 

12. A method of protecting privacy of the location of mo- 
bile terminals in a location system which includes a 
gateway and a positioning system, comprising: 

a) receiving, at said gateway, a location request 
from a client terminal specifying a target mobile 
terminal; 

b) performing a first privacy check on the loca- 
tion request using the privacy settings of the 
specified target mobile terminal; 

c) transmitting the location request to the posi- 
tioning system to obtain location information of 
the target mobile terminal; and 

d) performing a second privacy check on said 
location information using the privacy settings 
of said target mobile terminal. 

13. The method of claim 12, wherein said location sys- 
tem includes a plurality of gateways for respectively 
maintaining privacy settings'of the mobile terminals 
and a positioning system, 

wherein step (a) further comprises determin- 
ing which of said gateways maintains the privacy 
settings of the specified mobile terminal, 

wherein step (b) comprises performing said 



first privacy check on the location request using the 
privacy settings maintained in the determined gate- 
way for the specified target mobile terminal, and 
wherein step (d) comprises performing said 
5 second privacy check on the measurement result 
from said positioning system using the privacy set- 
tings maintained in the determined gateway for said 
target mobile terminal. 

10 14. The method of claim 13, wherein said positioning 
system comprises a plurality of mobile switching 
systems and wherein each of said gateways is con- 
nected to one or more of said mobile switching sys- 
tems, wherein step (c) further comprises determin- 
es ing which of the mobile switching systems the target 
mobile terminal is accessible, and transmitting said 
request to the determined mobile switching system 
to obtain said location information. 

20 15. The method of claim 12, 13 or 14, further compris- 
ing, following step (d), transmitting a copy of said 
location request to said positioning system at peri- 
odic intervals to obtain a plurality of location infor- 
mation of the target mobile terminal and transmit- 
25 ting the location information obtained for each of the 
transmitted copy to said client terminal. 

16. The method of claim 12, 13, 14 or 15, wherein step 
(d) further comprises processing said location infor- 

30 mation obtained from said positioning system ac- 
cording to privacy settings of said client terminal if 
the location information conforms to the privacy set- 
tings of said target mobile terminal, and transmitting 
the processed location information to the client ter- 
35 minal. 

17. The method of claim 12, 13, 14, 15 or 16, wherein 
said location request transmitted to said positioning 
system is an event-triggered location request to ob- 

40 tain location information of the target mobile termi- 
nal if a specified event occurs with respect to the 
target mobile terminal, and wherein step (d) further 
comprises performing said second privacy check on 
the location information if the privacy settings of the 

45 target mobile terminal is not altered before the lo- 
cation information is obtained from the positioning 
system, and transmitting a cancellation request to 
said positioning system if the privacy settings of the 
target mobile terminal is altered before the location 

50 information is obtained from the positioning system . 

18. A gateway of a location system, wherein the gate- 
way is one of a plurality of gateways of the location 
system, wherein the gateways respectively main- 

55 tain privacy settings of the mobile terminals, com- 
prising: 

means for receiving a location request from a 
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client terminal specifying a target mobile termi- 
nal and determining which of said gateways 
maintains the privacy settings of the specified 
mobile terminal; 

means for performing a first privacy check on 
the location request using the privacy settings 
maintained by the gateway for the specified tar- 
get mobile terminal; 

means for transmitting the location request to 
the positioning system to obtain location infor- 
mation of the target mobile terminal if the re- 
quest conforms to said privacy settings; and 

means for performing a second privacy check 
on said location information using the privacy 
settings maintained in the gateway for said tar- 
get mobile terminal. 

19. The system of any one of claims 1 to 11 or 18, 
wherein said gateway performs said second privacy 
check if the location request conforms to said priva- 
cy settings. 

20. The system of any one of claims 2 to 18, wherein 
each of said gateways which maintains privacy set- 
tings of the specified target mobile terminal, per- 
forms said second privacy check if the location re- 
quest conforms to said privacy settings. 

21. A location system comprising: 

a plurality of mobile terminals (205, 215); 

a client terminal (201 ,211) for transmitting a lo- 
cation request specifying a target mobile termi- 
nal; 

a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 
nal in response to a location request; and 

a plurality of gateways (202,21 2) for holding pri- 
vacy settings of the mobile terminals, transmit- 
ting the location request to the positioning sys- 
tem to obtain location information of the target 
mobile terminal, and performing a privacy 
check on said location information using the pri- 
vacy settings of said target mobile terminal. 

22. A location system comprising: 

a plurality of mobile terminals (205, 215); 
a client terminal (201 ,21 1 ) for transmitting a lo- 
cation request specifying a target mobile termi- 
nal; 



a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 
nal in response to a location request; 
5 a plurality of privacy managers (207,217) for 

maintaining the privacy settings of the mobile 
terminals and performing a privacy check using 
the privacy settings of a target mobile terminal; 
and 

w a plurality of gateways (202,212) for transmit- 

ting said location request to the positioning sys- 
tem to obtain location information of the target 
mobile terminal, and requesting the privacy 
managers ,to perform a privacy check on the 

15 obtained location information. 

23. A location system comprising: 

a plurality of mobile terminals (205,215); 
20 a client terminal (201 ,21 1 ) for transmitting a lo- 

cation request specifying a target mobile termi- 
nal; 

a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 

25 location information of the target mobile termi- 

nal in response to a location request; 
a plurality of privacy managers (207, 217) for 
maintaining the privacy settings of the mobile 
terminals and performing a privacy check using 

30 the privacy settings of a target mobile terminal; 

and 

a plurality of gateways (202, 212) for requesting 
said privacy manager, which maintains the pri- 
vacy settings of a target mobile terminal spec- 

35 jfied by the request, to perform a first privacy 

check on a location request of the client termi- 
nal, transmit said location request to the posi- 
tioning system to obtain location information of 
the target mobile terminal, and requesting said 

40 means to perform a second privacy check on 

the location information of the target mobile ter- 
minal. 

24. A location system comprising: 

45 

a plurality of mobile terminals (205, 215); 
a client terminal (201 , 21 1 ) for transmitting a lo- 
cation request specifying a target mobile termi- 
nal; 

so a positioning system (203, 204, 213, 214) ac- 

cessible to said mobile terminals for producing 
location information of the target mobile termi- 
nal in response to a location request; 
a plurality of gateways (202, 212) for maintain- 

55 ing privacy settings of the mobile terminals, 

each gateway receiving a location request from 
a client terminal, determining which of the gate- 
ways maintains the privacy settings of thespec- 
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ified target mobile terminal, and transmitting 
the location request to a gateway which main- 
tains the privacy settings of the speafied target 
mobile terminal, 

each gateway, which maintains the privacy set- 5 
tings of the specified target mobile terminal, 
performing a first privacy check on a location 
request received either from the client terminal 
or from other gateway using the privacy set- 
tings of the specified target mobile terminal, 10 
transmitting the request to the positioning sys- 
tem to obtain location information of the target 
mobile terminal, and performing a second pri- 
vacy check on said location information using 
the privacy settings maintained in the gateway, w 

25. A location system comprising: 

a plurality of mobile terminals (205, 215); 
a client terminal (201 , 21 1 ) for transmitting a lo- 20 
cation request specifying a target mobile termi- 
nal; 

a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 25 
nal in response to a location request; 
a plurality of gateways (202, 212) for maintain- 
ing privacy settings of the mobile terminals, 
each gateway receiving a location request from 
a client terminal, determining which of the gate- 30 
ways maintains the privacy settings of the spec- 
ified target mobile terminal, and transmitting 
the location request to a gateway which main- 
tains the privacy settings of the specified target 
mobile terminal, 35 
each gateway, which maintains the privacy set- 
tings of the specified target mobile terminal, 
transmitting said location request to the posi- 
tioning system to obtain location information of 
the target mobile terminal, and performing a pri- *o 
vacy check on the location information of the 
target mobile terminal using the privacy set- 
tings maintained in the gateway. 

26. A location system comprising: *5 

a plurality of mobile terminals (205, 215); 
a client terminal (201 , 211 ) for transmitting a lo- 
cation request specifying a target mobile termi- 
nal; 50 
a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 
nal in response to a location request; 
a plurality of privacy managers (207, 217) for 55 
maintaining the privacy settings of the mobile 
terminals and performing a privacy check using 
the privacy settings of a target mobile terminal; 
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and 

a plurality of gateways (202, 212), 
each gateway receiving a location request from 
a client terminal, determining which of the gate- 
ways is associated with the privacy manager 
which maintains the privacy settings of the 
specified target mobile terminal, and transmit- 
ting the location request to the determined 
gateway, 

each gateway, associated with the privacy 
manager which maintains the privacy settings 
of the specified target mobile terminal, request- 
ing the associated means to perform a first pri- 
vacy check on a location request of the client 
terminal, transmitting the location request to 
the positioning system to obtain location infor- 
mation of the target mobile terminal, and re- 
questing the associated means to perform a 
second privacy check on the obtained location 
information using said privacy settings. 

27. A location system comprising: 

a plurality of mobile terminals (205, 215); 
a client terminal (201 , 21 1 ) for transmitting a lo- 
cation request specifying a target mobile termi- 
nal; 

a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 
nal in response to a location request; 
a plurality of privacy managers (207, 217) for 
maintaining the privacy settings of the mobile 
terminals and performing a privacy check using 
the privacy settings of a target mobile terminal; 
and 

a plurality of gateways (202, 212), 
each gateway receiving a location request from 
a client terminal, determining which of the gate- 
ways is associated with the privacy manager 
which maintains the privacy settings of the 
specified target mobile terminal, and transmit- 
ting the location request to the determined 
gateway, 

each gateway, associated with the privacy 
manager which maintains the privacy settings 
of the specified target mobile terminal, request- 
ing the associated means to perform a first pri- 
vacy check on a location request of the client 
terminal, transmitting the location request to 
the positioning system to obtain location infor- 
mation of the target mobile terminal, and re- 
questing the associated means to perform a 
second privacy check on the obtained location 
information using said privacy settings. 

28. A location system comprising: 
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a plurality of mobile terminals (205, 215); 
a client terminal (201 ,211) for transmitting a lo- 
cation request specifying a target mobile termi- 
nal; 

a positioning system (203,204, 213,214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 
nal in response to a location request; 
a home register (206, 21 6) which stores identity 
of a gateway which maintains privacy settings 
of the mobile terminals; and 
a plurality of gateways (202, 212) for maintain- 
ing privacy settings of the mobile terminals, 
each gateway receiving a location request from 
a client terminal, sending an enquiry message 
to the home register to obtain the identity of the 
gateway if said identity is not known, and trans- 
mitting the location request to a gateway iden- 
tified by the obtained identity. 

29. A location system comprising: 



formation of the target mobile terminal. 

31. A location method, comprising; 

transmitting a location request to a location 
5 system, whereby the location system obtains loca 1 
tion information of a target mobile terminal specified 
by the location request and performs a first privacy 
check before obtaining the location information and 
a second privacy check after obtaining the location 
10 information; and 

receiving the location information from the lo- 
cation system after the first and second privacy 
checks. 

15 



20 



a plurality of mobile terminals (205, 215); 
a client terminal (201 , 21 1 ) for transmitting a lo- 
cation request specifying a target mobile termi- 25 
nal; 

a positioning system (203, 204, 213, 214) ac- 
cessible to said mobile terminals for producing 
location information of the target mobile termi- 
nal in response to a location request; 30 
a home register (206, 21 6) which stores identity 
of a gateway which maintains privacy settings 
of the mobile terminals; 
a privacy manager (207,217) for maintaining 
privacy settings of the mobile terminals and 35 
performing a privacy check using the privacy 
settings of a target mobile terminal; 
a home register (206, 21 6) for maintaining iden- 
tity of a gateway which accesses the privacy 
manager that maintains privacy settings of the *o 
mobile terminals; and 

a plurality of gateways (202, 212), each gate- 
way receiving a location request from the client 
terminal, sending a message to the home reg- 
ister that stores the identity of the gateway 4 $ 
which accesses the a privacy manager which 
maintains privacy settings of the target mobile 
terminal to obtain the identity of the gateway if 
the identity is not known, and transmitting the 
location request to a gateway identified by the so 
obtained identity. 

30. A location method, comprising; 

receiving a location request from a client ter- 
minal; 55 

obtaining location information of a target mo- 
bile terminal specified by the location request; and 

performing a privacy check on the location in- 
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